win_volgmer_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com

Detects win.volgmer.

rule win_volgmer_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.volgmer."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.volgmer"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    


    strings:
        $sequence_0 = { e8???????? 8bd7 c6843d1015000000 488d8d10150000 e8???????? 488d9510150000 488bce }
                                                                                                
        $sequence_1 = { 448bc7 488d8da0070000 4c8bf0 e8???????? 8bd7 c6843da007000000 488d8da0070000 }
                                                                                                
        $sequence_2 = { 84c0 75f0 488d542430 488d8dc0050000 ff542420 488bd8 }
                                                                                    
        $sequence_3 = { 8d4b41 888c24a0000000 488d8c24a0000000 41ffd6 8bcf }
                                                                        
        $sequence_4 = { 4885c0 7419 33d2 488bc8 41ffd5 }
                                                                        
        $sequence_5 = { 4533c0 498bd5 33c9 c744242800000008 }
                                                            
        $sequence_6 = { 33d2 0fb705???????? 41b8c1000000 0f1185d8090000 668985180a0000 0f2805???????? 0fb605???????? }
                                                                                                
        $sequence_7 = { 8d14c7 eb05 ba40000200 44894c2420 448bc6 }
                                                                        
        $sequence_8 = { ff542468 488b4580 488d8da0040000 ffd0 }
                                                            
        $sequence_9 = { e8???????? e8???????? e8???????? c705????????04000000 }
                                                            
        $sequence_10 = { 57 6804010000 6a40 ff15???????? 6800020000 }
                                                                        
        $sequence_11 = { 015314 85c0 0f8563fdffff 85f6 }
                                                            
        $sequence_12 = { 3b4b3b 52 3b5e3b 6a3b }
                                                            
        $sequence_13 = { 66a3???????? c705????????02000000 5d eb7e 6a00 6a00 }
                                                                                    
        $sequence_14 = { eb1d 8b0d???????? 8d442410 6a10 50 6852ff0000 }
                                                                                    
        $sequence_15 = { 8d45d0 8a10 3a11 751a 84d2 7412 }
                                                                                    
        $sequence_16 = { 4053 4883ec20 488d0d7be50100 ff15???????? 488bd8 4885c0 }
                                                                                    
        $sequence_17 = { 008a01010000 488b4708 440fb68001010000 0fb69000010000 4803d0 }
                                                                        
        $sequence_18 = { 014108 448b4108 418bc2 c1c005 }
                                                            
        $sequence_19 = { 448bc7 e8???????? 85c0 7447 807c243017 7540 b801030000 }
                                                                                                
        $sequence_20 = { e8???????? eb32 53 e8???????? 83c404 }
                                                                        
        $sequence_21 = { 85c0 7e25 03f0 8b4500 }
                                                            
        $sequence_22 = { 0f85d1010000 33ff 83c303 6a2f }
                                                            
        $sequence_23 = { 0f284da0 bb48000000 0f114702 0f114f12 0f2845b0 0f284dc0 }
                                                                                    
        $sequence_24 = { 488d542470 448bcf e8???????? 4c8b35???????? }
                                                            
        $sequence_25 = { 0101 44015104 4c8b942498000000 8b01 }
                                                            
        $sequence_26 = { c1fb06 83e03f 6bd030 895de4 8b049d80f16e00 }
                                                                        
        $sequence_27 = { eb7c c745e0e0ba6e00 ebbb d9e8 8b4510 dd18 }
                                                                                    
        $sequence_28 = { e9???????? c745dc02000000 c745e0e4ba6e00 8b4508 8bcf }
                                                                        
        $sequence_29 = { 668945e8 8b45d4 886de5 8b148580f16e00 8a4c1a2d }
                                                                        
        $sequence_30 = { c74048b8e46e00 8b4508 6689486c 8b4508 66898872010000 }
                                                                        
        $sequence_31 = { 6a00 50 e8???????? 6800010000 8d8318030000 6a00 }
                                                                                    
        $sequence_32 = { 0fb68418240e0000 02c2 02f0 0fb6ce }
                                                            
        $sequence_33 = { 014b14 397348 7410 488bcb }
                                                            
        $sequence_34 = { 83c408 85c0 742f 8b4c2418 }
                                                            
        $sequence_35 = { d9c9 d9f1 833d????????00 0f859c190000 8d0d90b86e00 }
                                                                        
        $sequence_36 = { 5f 5e c3 0fb74c2449 48896c2440 }
                                                                        
        $sequence_37 = { 39b139cf3909 3a10 3a17 3a31 3a9a3aa43ab2 3ab73ac33ad2 3ade }
                                                                                                
        $sequence_38 = { c7430c00000000 57 c7430800000000 894314 e8???????? }
                                                                        
        $sequence_39 = { 4c03c8 488d05eb1b0100 85ff 4c0f44c0 8b431c }
                                                                        
        $sequence_40 = { 8bc3 8d95f0fdffff c1e009 8d8870f66e00 2bd1 0f1f840000000000 }
                                                                                    
        $sequence_41 = { 83c8f0 40 8985c4f5ffff 8d95d0f9ffff c1e009 }
                                                                        
        $sequence_42 = { f30f7e0e 83e908 8d7608 660fd60f 8d7f08 8b048dd4926d00 }
                                                                                    
        $sequence_43 = { 7437 4c8d05f5040100 488d9411fefbff7f 4c2bc0 4885d2 741b }
                                                                                    
    condition:
        7 of them and filesize < 393216
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

395d7815-59ba-483e-a7af-6b107d368aec

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion